Privacy Policy

Account and manager data: name, email address, organization name, authentication identifiers, and settings.

Expert and contributor data: name, email, WhatsApp phone number and, where their company uses Slack, their Slack member ID and workspace ID, language, role, consent status and timestamps, and the messages, voice notes, photographs, videos, and transcripts a contributor sends.

Content data: the insights, knowledge records, drafts, social posts, images, and connected-account metadata created or managed in the Service.

Billing and subscription data: plan and expert contributor information, invoicing details including your billing country and, where you provide one, your VAT number, and payment records. Payment card details are collected and processed directly by our payment provider, Stripe; we do not receive or store your card number. Your VAT number is held on your customer record with Stripe.

Technical and usage data: log data, device and browser information, IP address, approximate location derived from it, and information about how the Service is used.

We collect data you provide directly (for example when you register, complete onboarding, or invite an expert), data contributors send through WhatsApp or, where their company has chosen it, Slack, data generated as you use the Service, and data received from connected third-party platforms you authorize (such as social or publishing accounts).

As processor, we process customer and expert data only to provide the Service to the controller and on its instructions; the legal basis for that processing rests with the controller.

As controller of our own operational data, we rely on:

• performance of a contract, to create and manage accounts and deliver the Service;
• legitimate interests, to secure, maintain, and improve the Service, prevent abuse, and communicate about it, balanced against your rights;
• legal obligation, to comply with law, including tax and accounting duties;
• consent, where required, for example for certain communications, which you can withdraw at any time.

WhiteBoar communicates with experts over WhatsApp using a single business number. A contributor is contacted only after the customer confirms a lawful basis and the contributor opts in. We log each consent event (including timestamps) as a record of opt-in, and we honor opt-out requests. Message content, voice notes, and transcripts are processed to produce knowledge records and drafts for the customer. WhatsApp messaging itself is transported by Meta Platforms under its own terms and privacy policy.

Where a customer chooses Slack instead of WhatsApp for some or all of its experts, WhiteBoar talks to those experts in a direct message in the customer’s own Slack workspace, through a WhiteBoar app that the customer installs there. The customer chooses Slack and uses it under its own agreement with Slack; Slack is not a sub-processor of WhiteBoar. The same consent and opt-out rules apply as on WhatsApp. In that direct message the expert sends us their answers, as text, voice clips, videos or photographs, and we send them our questions, requests to approve drafts, and the pictures they are asked to approve. We download the voice clips, videos and photographs from Slack using the access key described below, and we keep them, together with the messages we send and receive and their transcripts, in the same way as WhatsApp messages; a photograph can be offered as a picture for the expert’s posts. Section 8 says how long we keep them. Copies of these messages and files also stay in the customer’s Slack workspace, where they are kept, exported and deleted according to that workspace’s own settings, which the customer controls and we do not. To run this connection we store, encrypted, the access key Slack issues for the customer’s workspace, together with the workspace’s ID and name and the Slack member ID of the person who connected it. For each expert who uses Slack we store their Slack member ID and workspace ID. To match an expert to their Slack account, we look up members of the customer’s workspace by email address, and a manager can pick from a list that shows each member’s name and email address; we do not keep a copy of that list.

To transcribe voice notes and generate drafts, translations, and images, we use AI models and supporting infrastructure provided by sub-processors, accessed directly or through a model gateway. These sub-processors process the relevant content only to perform the requested task and under contractual confidentiality and security obligations. We do not permit them to use customer content to train their general models where such use can be disabled, consistent with our agreements.

Other sub-processors provide hosting, database, storage, and email delivery. The current list of sub-processors is published in our Data Processing Agreement (whiteboar.it/dpa), and where we act as processor we provide notice of changes as described there.

We share personal data with: the sub-processors described above; where a customer has chosen Slack, that customer’s own Slack workspace, to which we deliver messages for its experts as described in section 4; our payment provider, Stripe, which processes payment details and subscription billing under its own terms and privacy policy; the third-party publishing and social platforms you connect, when you choose to publish content to them; professional advisers, auditors, and authorities where required by law; and an acquirer in connection with a merger, acquisition, or sale of assets, subject to this Policy. We do not sell personal data.

We are based in the EU and host personal data in the EU. Some sub-processors may process data outside the EU/EEA. Where they do, we rely on an adequacy decision or appropriate safeguards such as the European Commission’s Standard Contractual Clauses, together with supplementary measures where needed. Messages and files in a customer’s Slack workspace are stored by Slack under the customer’s own agreement with Slack, including as to where that data is stored.

We keep personal data for as long as needed to provide the Service and for the purposes described in this Policy. As processor, we retain customer and expert data for the duration of the customer’s account and delete or return it within a reasonable period after the account ends or on the controller’s instruction, unless retention is required by law. We may keep limited records (for example consent logs and billing records) where necessary to meet legal obligations or establish, exercise, or defend legal claims.

Photographs, voice notes and videos an expert sends over WhatsApp or Slack are deleted 90 days after the conversation they belong to ends, even while the customer’s account is open. A conversation ends when it is abandoned, or when everything written from it has been published. Where neither has happened, for example a draft nobody approved, the material stays with the customer’s account and is deleted when the account ends. The text of what was said is kept with the customer’s content. So is a photograph the customer chose for a post that has already been published: we keep that photograph with the post rather than deleting it at 90 days.

These retention periods cover the copies we hold. They do not reach the copies of messages and files in a customer’s Slack workspace, which follow that workspace’s own settings, as described in section 4. We delete the access key we hold for a customer’s Slack workspace as soon as the customer disconnects Slack in WhiteBoar or removes our app from its workspace, and otherwise together with the rest of its data when its account ends, as described above. When the customer disconnects Slack in WhiteBoar, we also ask Slack to revoke that key.

When someone follows a link from a published post we record the visit, without the visitor’s IP address: the platform and website it came from, the country, the kind of device, and a one-way code that lets us recognize a repeated click. We keep those records for 13 months and then reduce them to monthly counts.

We use technical and organizational measures appropriate to the risk, including encryption in transit, encryption of stored credentials, access controls and least-privilege scopes, tenant isolation, and safeguards against server-side request forgery on URL ingestion and in-generation fetches. No system is completely secure, but we work to protect personal data and to detect and respond to incidents.

Subject to applicable law, you have the right to access, rectify, erase, restrict, and object to the processing of your personal data, and the right to data portability. Where processing is based on consent, you may withdraw it at any time without affecting prior processing.

If a customer business is the controller of your data, for example if you are an expert invited by your employer, please direct your request to that business; we will assist them as their processor. If that business uses Slack, copies of your messages and files in its Slack workspace are outside our control; to have them deleted, contact that business, which controls the workspace. For data we control, contact us using the details below. You also have the right to lodge a complaint with a supervisory authority, our lead supervisory authority is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), and you may also contact the supervisory authority of your own country.

The Service uses only cookies and similar technologies that are strictly necessary to operate it, for example to keep you signed in and to secure your session. We do not currently use analytics or advertising cookies. If that changes, we will update this Policy and, where required, ask for your consent first.

The Service is intended for businesses and is not directed to children. We do not knowingly collect personal data from children. If you believe a child has provided personal data, contact us and we will take appropriate steps to delete it.

We may update this Policy from time to time. When we make a material change, we will update the effective date and, where appropriate, provide additional notice. Your continued use of the Service after the change takes effect constitutes acknowledgment of the updated Policy.

This Policy is published in English, Italian, and Polish. The English version is the authoritative text; in case of any discrepancy, the English version prevails.

For privacy questions or to exercise your rights, contact WhiteBoar OÜ, Sakala tn 7-2, 10141 Tallinn, Estonia, or email privacy@whiteboar.it.